L2. Cryptography: Symmetric, Asymmetric, Hashing & PKI
Course outlineLesson 2 of 20
Cryptography underpins nearly every security control. The Security+ exam tests your ability to choose the right algorithm, understand key exchange, and explain how PKI enables trust at scale.
Symmetric Encryption
Symmetric encryption uses the same key to encrypt and decrypt. It is fast and efficient for bulk data, but requires a secure channel to share the key.
Key algorithms tested on Security+:
| Algorithm | Key Size | Notes |
|---|---|---|
| AES | 128, 192, 256 bit | Current standard; AES-256 is preferred |
| 3DES | 112/168 bit effective | Legacy; being phased out |
| ChaCha20 | 256 bit | Used in TLS 1.3 for mobile/low-power |
Asymmetric Encryption
Asymmetric encryption uses a mathematically linked key pair: public key (shared freely) and private key (kept secret). Slower than symmetric, but solves the key distribution problem.
- Encryption with public key: only the private key holder can decrypt
- Digital signature with private key: anyone with the public key can verify authenticity and non-repudiation
Common algorithms: RSA (2048/4096 bit), ECC (256 bit, equivalent strength to RSA 3072 at smaller size), Diffie-Hellman (key exchange only).
Hashing
Hashing is a one-way function that produces a fixed-length digest. You cannot reverse a hash to recover the original input.
Uses: password storage (salted hash), file integrity verification, digital signatures.
| Algorithm | Output Size | Status |
|---|---|---|
| MD5 | 128 bit | Broken for security; legacy only |
| SHA-1 | 160 bit | Deprecated |
| SHA-256 | 256 bit | Current standard |
| SHA-3 | Variable | Modern alternative |
Public Key Infrastructure (PKI)
PKI is the system for managing digital certificates that bind public keys to identities. Certificate Authority (CA): trusted entity that signs certificates. Root CA signs intermediate CAs; intermediate CAs sign leaf certificates (chain of trust). Certificate revocation: CRL (Certificate Revocation List, batch) or OCSP (Online Certificate Status Protocol, real-time). Exam tip: In hybrid encryption (used in TLS), asymmetric encryption is used to exchange a symmetric session key; bulk data is then encrypted with the faster symmetric key.
- ✓Symmetric encryption (AES) uses the same key to encrypt and decrypt; it is fast but requires secure key distribution
- ✓Asymmetric encryption (RSA, ECC) uses a public/private key pair; asymmetric solves key distribution but is slower
- ✓Hashing is one-way: SHA-256 is the current standard; salting prevents rainbow table attacks on stored passwords
- ✓PKI chain of trust: Root CA signs Intermediate CA; Intermediate CA signs leaf (end-entity) certificates
- ✓TLS uses hybrid encryption: asymmetric to exchange the session key, then symmetric (AES) for bulk data
1. Which encryption algorithm is the current industry standard for symmetric encryption?
2. A developer stores passwords by hashing them with SHA-256 and a unique random value per user. What is the random value called and what attack does it prevent?
3. In a PKI hierarchy, which entity is responsible for signing the certificates of intermediate CAs?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.